Forensic work, kept under your control.
DFIRBot Pro is a local-first investigation toolkit for repeatable collection, parsing, triage, timelines, and defensible findings.
A practical investigation toolkit
- Repeatable workflows. Run collection, parsing, triage, and validation steps from one command-line workspace.
- Evidence-aware output. Preserve context through timelines, graph relationships, rules, and machine-readable findings.
- Local-first operation. Use the embedded service on your machine or connect to an FGIT/DFIRBot server you operate.
- Broad platform support. Release builds are prepared for macOS, Linux, and Windows.
See the investigation workspace
Follow evidence through a timeline, inspect artifact metadata and hashes, and connect related files, processes, and network activity in one focused workspace.
License
One-time purchase · 5,000 TL
Pay once for DFIRBot Pro. There is no subscription, free tier, or trial edition.
Five devices
Activate up to five devices at the same time. You can remove an old device from the license portal.
Online activation
The application checks the license service when it starts. No forensic evidence is sent to the license service.
Plain delivery
Your license key is delivered to the email used during checkout and can be configured with DFIRBOT_LICENSE_KEY.
What stays local
DFIRBot processes investigative data in the workspace and server selected by you. The commercial license service handles only licensing records, device activation, and the payment email needed for delivery and support.
macOS · Linux · Windows · local-first · one-time license · five active devices
Downloads
Getting started
After purchase, download the release for your platform, set your license key, and start DFIRBot online once to activate the device.
export DFIRBOT_LICENSE_KEY="DFB-..." dfirbot version
Secure payment
Payments are processed by iyzico. We accept Visa and Mastercard.
Payment and license delivery are subject to our Mesafeli Satış Sözleşmesi and Teslimat ve İade Şartları.